1. Data controller

Innosus Oy (trading as Onelab)

Business ID: 3105686-7

Ukkohauentie 11–13 A, 02170 Espoo

2. Purpose of the app

Kartoittaja is a mobile application intended for professional use in carrying out asbestos surveys in the field. The app is used only by surveyors authorised by Onelab and its partners (including Asbestipro). The app is not openly available and it is not possible to register for it without separately granted credentials.

3. Data processed

User authentication - email address, password hash, optional Apple ID.
Survey site - the customer's name, address, contact details, identifying information of the site.
Samples - description of the sampling, location in the building, material information, photographs.
Push notification identifier - the device identifier used for job assignment notifications.
Technical logs - operating system version and error reports for troubleshooting.

The app does NOT collect location data, audio, contacts or advertising identifiers.

4. Permissions

Camera - photographing samples and the survey site.
Photo library - attaching previously taken photographs to a sample.
Push notifications - immediate notification of new job assignments.

5. Legal basis for the processing

Performance of a contract (GDPR Art. 6(1)(b)) - carrying out the asbestos survey in accordance with the order.
Legal obligation (GDPR Art. 6(1)(c)) - asbestos legislation (Government Decree 798/2015) requires the survey documentation to be retained.
Legitimate interest (GDPR Art. 6(1)(f)) - development of operations, information security and prevention of misuse.

6. Location of the data and subcontractors

Data is stored in the Labbmate system and in the following subcontractor services:

Supabase - database and photo storage (servers within the EU, encryption at rest).
Expo / Google Firebase - delivery of push notifications.
Resend - sending service emails.
Apple Sign-In - optional sign-in method.

Some subcontractors may process data outside the EU/EEA. Protection is ensured with the European Commission's standard contractual clauses (SCC).

7. Retention period

Survey data and photographs - 10 years in accordance with the statutory retention obligation.
User accounts - for as long as the user is active; deleted immediately upon request.
Technical logs - a maximum of 12 months.

8. Information security

All connections are encrypted with the TLS 1.2+ protocol. Access to personal data is restricted by Row Level Security rules to the organisation's authorised users. User credentials are stored as a password hash (bcrypt/argon2). Photographs are stored encrypted at rest.

9. Rights of the data subject

You have the rights provided under the GDPR:

Right of access to your own data
Right to rectification and completion
Right to erasure (except data that must be retained by law)
Right to restriction of processing
Right to object to the processing
Right to data portability
Right to lodge a complaint with the Office of the Data Protection Ombudsman: tietosuoja.fi

Requests: info@onelab.fi.

10. Deletion of the account and the data

A user can request the deletion of their account and the personal data associated with it by sending an email to info@onelab.fi. Survey data subject to the statutory retention obligation is retained for 10 years even if the account is deleted.

11. Changes

We update this policy as necessary. Material changes are announced in the app and by email.

12. Contact

Questions: info@onelab.fi.

Privacy policy for the Kartoittaja app